How to disable the HTTP TRACE requests, SAP security note 1422175

SAP security note 1422175, "How to disable the HTTP TRACE requests". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

You want to block the HTTP TRACE requests.

Solution

Follow these steps to disable HTTP TRACE requests:

• Start the offline configuration editor: Start the offlinecfgeditor tool from /usr/sap/<SID>/<instance>/j2ee/configtool directory.
• Navigate to the configuration file: Go to cluster_data -> server -> persistent -> servlet_jsp -> global-web.xml.
• Edit the global-web.xml file: Switch to edit mode and add the following entries just before the <login-config> element: <security-constraint><web-resource-collection><web-resource-name>DisableExploitTraceHTTP</web-resource-name><url-pattern>/*</url-pattern><http-method>TRACE</http-method></web-resource-collection><auth-constraint><role-name>SAP_BLOCK_TRACE_NON_EXISTENT_ROLE</role-name></auth-constraint></security-constraint>. Important: ensure that SAP_BLOCK_TRACE_NON_EXISTENT_ROLE does not exist in the security roles of the J2EE engine.
• Save the changes: Click the OK button to save the settings.
• Restart the cluster: Restart the SAP cluster for the changes to take effect.

Reason and prerequisites

HTTP TRACE requests, as described in RFC 2616 Section 9.8, can be used to facilitate session hijacking attacks. It is recommended to block them to enhance security. The blocking mechanism involves using a non-existent security role against which incoming TRACE requests are checked.

Ensure that you have applied the necessary Support Package (SP) of the Engine or the patch for the webcontainer service. This is important because the customization will be replaced by the newer SDAs as per Note 870170.

References

• Note 1473116 – Filtering HTTP TRACE requests in AS Java
• Note 870170 – Customization is lost after upgrade of the Engine